McEliece attacks and Linux roots lead security roundup

Post-quantum cryptography faced fresh cryptanalysis of Classic McEliece while Linux kernel and library maintainers shipped multiple local privilege and memory-safety fixes. Several moderate and low-severity issues also landed in common open-source components.

Quasipolynomial attacks on Classic McEliece

New eprint papers describe quasipolynomial attacks against Classic McEliece. Participants on the NIST pqc-forum now recommend against the scheme's proposed parameters. The discussion matters for anyone tracking post-quantum standardization and parameter selection.

Four Linux kernel local-root vulnerabilities

An oss-security report disclosed four Linux local-root issues named DirtyAH6, PPPoEject, TUNderflow, and DiagSpill, each assigned CVEs and shipped with fixes after a distribution embargo. Some of the flaws are remotely reachable under narrow conditions. Kernel users and distributors need the updates to close local privilege-escalation paths.

GnuPG maintainers debate gpg.fail findings

GnuPG maintainers and the authors of gpg.fail examined a claimed remote-code-execution zero-day in gpgsm debug code together with a previously fixed libgcrypt RSASSA-PSS problem. The exchange ran to eleven messages from seven participants on oss-security. The thread underscores continued scrutiny of OpenPGP tooling and its cryptographic primitives.

Glibc DNS stub resolver assertion failure

The GNU C Library released advisory GLIBC-SA-2026-0021 for an assertion failure in the DNS stub resolver when processing long search domains from resolv.conf. Systems that rely on glibc name resolution should install the update. The flaw can disrupt resolver stability under crafted configuration.

Write-past-end buffer error in Imager::File::PNG

CVE-2026-73639 records a write past the end of the row buffer in Imager::File::PNG versions from 1.003 before 1.004 when reading a PNG that contains a tRNS transparency chunk inside read_direct8. Perl applications that load PNGs through the module are affected. Upgrading removes the out-of-bounds write.

Apache Karaf ThreadLocal ClassLoader retention

Apache Karaf announced moderate CVE-2026-92230 in which static ThreadLocal caching of XML factories fails to release ClassLoader references. Bundle refresh therefore produces unbounded Metaspace growth. Operators running Karaf should apply the patch to avoid resource exhaustion.

Apache Airflow asset-event authorization gap

Apache Airflow published low-severity CVE-2026-75157 because the DELETE endpoints for asset queued events check Dag READ permission instead of Dag EDIT. Users holding only READ can therefore delete queued events and suppress asset-triggered scheduling. Administrators should upgrade to restore the intended authorization boundary.

Out-of-bounds read in Imager TIFF loader

CVE-2026-73638 covers an out-of-bounds read in Imager versions from 0.45_02 before 1.035 caused by unchecked start offsets inside tiff_load_ifd. Code that processes TIFF files with the Perl module can read outside the EXIF block. The 1.035 release corrects the bounds check.